# v1 conformance fixture

The fixture contains one fixed certificate and its short registry history:

- `claims.json` is the unsigned statement;
- `issuer.json` contains the public verification key;
- `certificate.json` is the expected signed result.
- `registry.json` contains its signed issuance and cancellation events.
- `checkpoint.json` anchors that exact two-event registry.
- `key-lifecycle.json` covers overlap, retirement, future activation, and a
  compromised key.
- `archive.json` contains the complete public record set and its archive
  digest.
- `invalid-cases.json` describes small mutations that every validator must
  reject at the listed JSON Pointer.

The fixture uses the first Ed25519 test key from RFC 8032. Its private seed is
included in `generate.mjs` so another implementation can reproduce the exact
signature. It is public test material and must never be used to issue a real
certificate.

Regenerate the deterministic fixture after building the package:

```bash
npm run conformance:generate
```

A conforming implementation should produce the certificate digest
`9c1e71e653259d6ab6e67adeae0d451d2b32d1d778da99ff50758e65a2f789bb`
and verify the signature in `certificate.json`.
It should also reproduce both registry event digests and signatures exactly.
Signature algorithm, key ID, creation time, and scope are part of each signed
input. Changing that metadata without signing again must fail verification.

The standard-library Python implementation in
[`../python/verify_v1.py`](../python/verify_v1.py) performs that independent
reproduction without importing this TypeScript package.